# Migrating from Intune to Hexnode: A Zero-Downtime Technical Playbook

This migration hub provides administrators, IT teams, and solution partners with a structured framework for migrating endpoints, policies, identities, applications, and compliance workflows from Intune to Hexnode.

The guide is organized into five operational phases:

 **1. Assessment
2. Parallel Deployment
3. Migration Execution
4. Validation
5. Decommissioning** 
It also includes:

- Rollback planning
- Downtime expectations
- Risk analysis
- Common migration failure scenarios
- Best practices for enterprise-scale deployments

Prerequisites
-------------

Before starting migration:

- Administrative access to both Intune and Hexnode portals
- Global Administrator or equivalent permissions
- Device inventory export from Intune
- Identity provider documentation
- Existing compliance and conditional access policies
- Application deployment inventory
- Certificate inventory
- Enrollment method documentation
- Network and firewall requirements review

Migration Architecture Overview
-------------------------------

### Recommended Migration Model

For large-scale deployments, Hexnode recommends a phased coexistence model instead of a direct cutover.

### Typical Migration Flow

1. Intune Environment
2. Assessment & Inventory
3. Parallel Hexnode Setup
4. Pilot Device Migration
5. Department-wise Rollout
6. Validation &; Monitoring
7. Intune Decommissioning

Phase 1 – Assessment
--------------------

The assessment phase identifies all dependencies, policies, and enrollment models currently managed through Intune.

### 1.1 Export Device Inventory from Intune

Generate a complete inventory of:

- Windows devices
- macOS devices
- iPhones and iPads
- Android devices
- BYOD endpoints
- Shared and kiosk devices

#### Required Data Points

**Category****Details****Device identifiers**Serial number, IMEI, device name**Ownership**Corporate or personal**OS versions**Windows, Android, iOS, macOS versions**Enrollment type**Autopilot, ADE, BYOD, Android Enterprise**Assigned users**UPN and department**Compliance state**Current compliance status#### Recommended Actions

- Identify inactive devices
- Remove duplicate records
- Flag unsupported OS versions
- Separate pilot groups

### 1.2 Application Dependency Mapping

Create a catalog of all managed applications.

#### Assess:

- Required business applications
- Line-of-business apps
- Win32 applications
- Store apps
- VPP applications
- Managed Google Play apps
- Scripts and PowerShell deployments

#### Document:

**Requirement****Example****Silent install support**MSI, PKG**Licensing dependencies**Microsoft Store, Apple VPP**VPN dependencies**Per-app VPN**Certificate dependencies**SCEP, PKI**App configurations**Managed app configs Note: 
Some Intune-specific app deployment configurations may require redesign during migration.

 

### 1.3 Compliance Policy Audit

Review all compliance policies currently enforced through Intune.

#### Validate: 

- Password policies
- Encryption requirements
- Root/jailbreak detection
- Antivirus requirements
- OS version requirements
- Device health attestation
- Firewall policies

**Recommended Outcome:** Create a policy equivalency matrix between Intune and Hexnode.

**Intune Policy****Hexnode Equivalent****Notes****BitLocker enforcement**[BitLocker policy](https://www.hexnode.com/mobile-device-management/help/how-to-manage-bitlocker-with-hexnode-mdm/) for WindowsVerify recovery key workflow**Password compliance**[Password policy](https://www.hexnode.com/mobile-device-management/help/hexnode-mdm-password-policy-for-windows/) for WindowsMatch complexity rules### 1.4 Conditional Access Review

Analyze identity and access dependencies.

**Review:**

- Conditional access rules
- MFA integrations
- Entra ID device trust requirements
- SSO dependencies
- Zero Trust workflows

**Key Questions:**

- Which applications require compliant devices?
- Which workflows rely on Intune compliance signals?
- Are there security baselines tied to Microsoft security services?

### 1.5 Enrollment Type Identification

Identify all active enrollment methods.

#### Common Enrollment Types 

**Platform****Enrollment Method****Windows**Autopilot**Apple**ADE**Android**Android Enterprise**BYOD (iOS)**User enrollment/profile enrollment**Why This Matters:** Migration complexity varies significantly based on enrollment type.

Phase 2 – Parallel Deployment
-----------------------------

This phase establishes Hexnode alongside Intune before device migration begins.

### 2.1 Co-management Strategies

During coexistence, some devices may temporarily remain managed by both platforms.

**Strategy****Use Case****Pilot coexistence**Small test groups**Department-based rollout**Large enterprises**Region-wise migration**Global deployments#### Best Practices:

- Avoid duplicate compliance enforcement
- Prevent policy conflicts
- Separate deployment scopes clearly

### 2.2 Hybrid Coexistence Planning

Define which services remain in Intune during transition.

**Service****Temporary Ownership****Conditional access**Intune**Application deployment**Hexnode**Compliance**Transition phase**Asset tracking**Hexnode### 2.3 Identity Federation

Configure identity integration.

#### Supported Identity Providers: 

- [Entra ID](https://www.hexnode.com/mobile-device-management/help/azure-active-directory-integration-with-hexnode-mdm/)
- [Okta](https://www.hexnode.com/mobile-device-management/help/okta-integration-with-hexnode-mdm/)
- [Google Workspace](https://www.hexnode.com/mobile-device-management/help/how-to-integrate-g-suite-with-hexnode/)
- [Active Directory](https://www.hexnode.com/mobile-device-management/help/microsoft-active-directory-integration-with-hexnode-mdm/)

#### Validation Checklist:

- SSO login works
- Group sync functions correctly
- User provisioning succeeds
- RBAC mapping is validated

### 2.4 Token and Certificate Planning

Review all certificate dependencies before migration.

#### Common Components: 

- APNs certificates
- Android Enterprise tokens
- SCEP certificates
- PKI integrations
- VPN certificates

 Note: 
Expired certificates are a common migration failure source.

 

Phase 3 – Migration Execution
-----------------------------

This phase handles actual endpoint movement from Intune to Hexnode.

### Windows Migration

#### 3.1 [Windows Autopilot](https://www.hexnode.com/mobile-device-management/help/provisioning-windows-devices-with-windows-autopilot/)

1. Export Autopilot device records
2. Remove deployment profile assignments
3. Configure Windows enrollment in Hexnode
4. Re-register devices where required
5. Apply baseline policies

**Considerations:**

- Existing Autopilot registrations may require cleanup
- Hybrid Entra ID join environments need additional validation
- BitLocker recovery workflows should be tested first

### Android Migration

#### 3.2 [Android Enterprise](https://www.hexnode.com/mobile-device-management/help/getting-started-with-android-enterprise-program/)

- Fully managed devices
- Work profile
- Dedicated devices
- Corporate-owned work profile

#### Recommended Process:

- Remove Intune work profile
- Re-enroll through Hexnode
- Reassign managed Google Play apps
- Reapply restrictions and compliance

 Note: 
Some Android migrations may require factory reset depending on ownership model.

 

### Apple Migration

#### 3.3 [Apple ADE](https://www.hexnode.com/mobile-device-management/help/enrollment-of-apple-devices-through-dep/)

- Assign devices to Hexnode UEM server in Apple Business Manager
- Remove old MDM profiles
- Re-enroll devices
- Deploy configuration profiles
- Validate supervision status

**Recommended Validation:**

- ADE assignment status
- VPP app reassignment
- Supervision retention
- Activation lock handling

### BYOD Migration

#### 3.4 [BYOD](https://www.hexnode.com/mobile-device-management/help/getting-started-with-bring-your-own-device-byod-management/)

BYOD migrations require special handling to minimize user disruption.

#### Recommended Approach:

- User communication campaign
- Self-service enrollment instructions
- Staggered migration windows
- Clear rollback instructions

#### User Experience Priorities: 

- Preserve personal data
- Minimize app reauthentication
- Reduce downtime

### 3.5 Application Reassignment

Reassign applications after enrollment.

#### Validate: 

- Licensing availability
- Silent deployment support
- VPN dependencies
- Managed app configurations
- Data protection policies

Phase 4 – Validation
--------------------

Validation confirms operational readiness after migration.

### 4.1 Compliance Verification

#### Validate: 

- Device encryption
- Passcode enforcement
- OS compliance
- Threat detection
- Device restrictions

**Validation Area****Recommended Sample Size****Pilot users**100%**Production rollout**10–20%### 4.2 Reporting Validation

#### Verify: 

- Device inventory reporting
- Compliance reports
- Audit logs
- Application deployment status
- Security incident visibility

### 4.3 Security Posture Checks

#### Focus Areas: 

- Conditional access continuity
- Certificate trust chains
- VPN functionality
- Email access restrictions
- Endpoint protection integration

### 4.4 User Experience Testing

#### Test Scenarios: 

- First login experience
- App access
- VPN connectivity
- Wi-Fi onboarding
- Password resets
- Device compliance remediation

Phase 5 – Decommissioning
-------------------------

Once migration is validated, begin retiring Intune dependencies.

### 5.1 Retire Old Policies

#### Gradually disable: 

- Device compliance policies
- Configuration profiles
- Legacy scripts
- App assignments

**Best Practice:** Disable in stages instead of deleting immediately.

### 5.2 Cleanup Certificates

#### Remove unused: 

- APNs certificates
- SCEP integrations
- PKI connectors
- Enrollment tokens

### 5.3 Remove Legacy Profiles

#### Ensure devices no longer retain: 

- Intune MDM profiles
- Legacy certificates
- Deprecated VPN profiles
- Obsolete Wi-Fi configurations

### 5.4 Archive Reporting

#### Before complete shutdown: 

- Export audit logs
- Archive compliance reports
- Retain security history
- Preserve licensing documentation

Rollback Strategies
-------------------

A rollback plan should exist before any production migration.

**Migration Stage****Rollback Option****Pilot phase**Re-enroll in Intune**Parallel coexistence**Shift workloads back**Production rollout**Department-level rollback**Full cutover**Disaster recovery plan#### Rollback Best Practices:

- Retain Intune licenses during transition
- Keep compliance policies inactive instead of deleted
- Preserve deployment groups
- Document rollback ownership

Downtime Expectations
---------------------

**Platform****Typical User Impact****Windows Autopilot**Low to medium**Android Enterprise**Medium**Apple ADE**Low**BYOD**Medium#### Common Downtime Scenarios:

- App reauthentication
- VPN reprovisioning
- Device restart requirements
- Compliance re-evaluation

**Recommended Practice:** Perform migrations during low-impact business hours.

Risk Matrix
-----------

**Risk****Severity****Likelihood****Mitigation****Certificate expiration**HighMediumPre-migration certificate audit**Conditional access lockout**HighMediumPilot testing**App deployment failure**MediumMediumStaged rollout**Enrollment failures**HighLowValidation testing**User disruption**MediumHighCommunication planning**Duplicate policy conflicts**MediumMediumScope isolationCommon Failure Scenarios
------------------------

- **Conditional Access Lockout:**
    - **Cause:** Compliance dependencies still reference Intune.
    - **Prevention:** Validate all access policies before migration.
- **Android Work Profile Removal Failure:**
    - **Cause:** Residual management components remain active.
    - **Prevention:** Use standardized unenrollment procedures.
- **Apple ADE Assignment Delays:**
    - **Cause:** Apple Business sync latency.
    - **Prevention:** Allow synchronization time before enrollment.
- **BitLocker Recovery Key Loss:**
    - **Cause:** Encryption workflows not validated.
    - **Prevention:** Test recovery workflows before production rollout.
- **Duplicate Configuration Policies:**
    - **Cause:** Policies deployed simultaneously from both platforms.
    - **Prevention:** Clearly define coexistence boundaries.

Recommended Enterprise Migration Strategy
-----------------------------------------

For environments managing 50k–100k devices:

- Begin with a pilot group
- Migrate department-wise
- Maintain coexistence temporarily
- Validate security posture continuously
- Delay Intune decommissioning until audit completion